Merge git://git.infradead.org/~dwmw2/mtd-2.6.35

* git://git.infradead.org/~dwmw2/mtd-2.6.35:
  jffs2: update ctime when changing the file's permission by setfacl
  jffs2: Fix NFS race by using insert_inode_locked()
  jffs2: Fix in-core inode leaks on error paths
  mtd: Fix NAND submenu
  mtd/r852: update card detect early.
  mtd/r852: Fixes in case of DMA timeout
  mtd/r852: register IRQ as last step
  drivers/mtd: Use memdup_user
  docbook: make mtd nand module init static

diff --combined drivers/mtd/mtdchar.c
index 000d65e,8b223c0..91c8013
--- 1/drivers/mtd/mtdchar.c
--- 2/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@@ -404,14 -404,9 +404,9 @@@ static int mtd_do_writeoob(struct file 
        if (ops.ooboffs && ops.ooblen > (mtd->oobsize - ops.ooboffs))
                return -EINVAL;
  
-       ops.oobbuf = kmalloc(length, GFP_KERNEL);
-       if (!ops.oobbuf)
-               return -ENOMEM;
- 
-       if (copy_from_user(ops.oobbuf, ptr, length)) {
-               kfree(ops.oobbuf);
-               return -EFAULT;
-       }
+       ops.oobbuf = memdup_user(ptr, length);
+       if (IS_ERR(ops.oobbuf))
+               return PTR_ERR(ops.oobbuf);
  
        start &= ~((uint64_t)mtd->oobsize - 1);
        ret = mtd->write_oob(mtd, start, &ops);
@@@ -468,7 -463,8 +463,7 @@@ static int mtd_do_readoob(struct mtd_in
        return ret;
  }
  
 -static int mtd_ioctl(struct inode *inode, struct file *file,
 -                   u_int cmd, u_long arg)
 +static int mtd_ioctl(struct file *file, u_int cmd, u_long arg)
  {
        struct mtd_file_info *mfi = file->private_data;
        struct mtd_info *mtd = mfi->mtd;
@@@ -839,17 -835,6 +834,17 @@@
        return ret;
  } /* memory_ioctl */
  
 +static long mtd_unlocked_ioctl(struct file *file, u_int cmd, u_long arg)
 +{
 +      int ret;
 +
 +      lock_kernel();
 +      ret = mtd_ioctl(file, cmd, arg);
 +      unlock_kernel();
 +
 +      return ret;
 +}
 +
  #ifdef CONFIG_COMPAT
  
  struct mtd_oob_buf32 {
@@@ -864,6 -849,7 +859,6 @@@
  static long mtd_compat_ioctl(struct file *file, unsigned int cmd,
        unsigned long arg)
  {
 -      struct inode *inode = file->f_path.dentry->d_inode;
        struct mtd_file_info *mfi = file->private_data;
        struct mtd_info *mtd = mfi->mtd;
        void __user *argp = compat_ptr(arg);
@@@ -901,7 -887,7 +896,7 @@@
                break;
        }
        default:
 -              ret = mtd_ioctl(inode, file, cmd, (unsigned long)argp);
 +              ret = mtd_ioctl(file, cmd, (unsigned long)argp);
        }
  
        unlock_kernel();
@@@ -969,7 -955,7 +964,7 @@@ static const struct file_operations mtd
        .llseek         = mtd_lseek,
        .read           = mtd_read,
        .write          = mtd_write,
 -      .ioctl          = mtd_ioctl,
 +      .unlocked_ioctl = mtd_unlocked_ioctl,
  #ifdef CONFIG_COMPAT
        .compat_ioctl   = mtd_compat_ioctl,
  #endif

diff --combined fs/jffs2/acl.c
index a33aab6,64d3b4b..54a92fd
--- 1/fs/jffs2/acl.c
--- 2/fs/jffs2/acl.c
+++ b/fs/jffs2/acl.c
@@@ -234,8 -234,9 +234,9 @@@ static int jffs2_set_acl(struct inode *
                        if (inode->i_mode != mode) {
                                struct iattr attr;
  
-                               attr.ia_valid = ATTR_MODE;
+                               attr.ia_valid = ATTR_MODE | ATTR_CTIME;
                                attr.ia_mode = mode;
+                               attr.ia_ctime = CURRENT_TIME_SEC;
                                rc = jffs2_do_setattr(inode, &attr);
                                if (rc < 0)
                                        return rc;
@@@ -419,7 -420,7 +420,7 @@@ static int jffs2_acl_setxattr(struct de
        return rc;
  }
  
 -struct xattr_handler jffs2_acl_access_xattr_handler = {
 +const struct xattr_handler jffs2_acl_access_xattr_handler = {
        .prefix = POSIX_ACL_XATTR_ACCESS,
        .flags  = ACL_TYPE_DEFAULT,
        .list   = jffs2_acl_access_listxattr,
@@@ -427,7 -428,7 +428,7 @@@
        .set    = jffs2_acl_setxattr,
  };
  
 -struct xattr_handler jffs2_acl_default_xattr_handler = {
 +const struct xattr_handler jffs2_acl_default_xattr_handler = {
        .prefix = POSIX_ACL_XATTR_DEFAULT,
        .flags  = ACL_TYPE_DEFAULT,
        .list   = jffs2_acl_default_listxattr,

diff --combined fs/jffs2/fs.c
index 8bc2c80,26037e2..459d39d
--- 1/fs/jffs2/fs.c
--- 2/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@@ -169,13 -169,13 +169,13 @@@ int jffs2_do_setattr (struct inode *ino
        mutex_unlock(&f->sem);
        jffs2_complete_reservation(c);
  
 -      /* We have to do the vmtruncate() without f->sem held, since
 +      /* We have to do the simple_setsize() without f->sem held, since
           some pages may be locked and waiting for it in readpage().
           We are protected from a simultaneous write() extending i_size
           back past iattr->ia_size, because do_truncate() holds the
           generic inode semaphore. */
        if (ivalid & ATTR_SIZE && inode->i_size > iattr->ia_size) {
 -              vmtruncate(inode, iattr->ia_size);      
 +              simple_setsize(inode, iattr->ia_size);
                inode->i_blocks = (inode->i_size + 511) >> 9;
        }       
  
@@@ -465,7 -465,12 +465,12 @@@ struct inode *jffs2_new_inode (struct i
        inode->i_blocks = 0;
        inode->i_size = 0;
  
-       insert_inode_hash(inode);
+       if (insert_inode_locked(inode) < 0) {
+               make_bad_inode(inode);
+               unlock_new_inode(inode);
+               iput(inode);
+               return ERR_PTR(-EINVAL);
+       }
  
        return inode;
  }